Regular Expression Denial of Service (ReDoS) in Ruby Date Gem
Summary
CVE-2021-41817: Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. Affects ruby across 3 version ranges.
< 2.7.5-r0
< 4f9b8e946ba98f0a1774f8e677baa4a45637ebb3
>= 95aff214687a5e12c3eb57d056665741e734c188, < 0db68f023372b634603c74fca94588b457be084c
Fixed in 2.7.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ruby Date gem is a part of the Ruby programming language and provides functionality for working with dates and times. It is widely used in Ruby applications for parsing and manipulating dates. However, the Date gem is vulnerable to a Regular Expression Denial of Service (ReDoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41817, exists in the Date gem through version 3.2.0 for Ruby. It is caused by a flaw in the Date.parse method, which can be exploited by an attacker to launch a ReDoS attack by providing a long string as input. This can lead to a denial of service condition, where the application becomes unresponsive or crashes due to excessive CPU usage. The fixed versions of the Date gem are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
How To Fix
Minimum fixed version
2.7.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Date gem is not feasible immediately, a possible workaround is to validate and sanitize user input before passing it to the Date.parse method. This can involve implementing input length restrictions or using a different parsing method that is not vulnerable to ReDoS attacks. Here is an example of input validation in Ruby:
input = params[:date]
if input.length <= 100
date = Date.parse(input)
else
# Handle error or provide alternative behavior
end
Conclusion
The Regular Expression Denial of Service (ReDoS) vulnerability in the Ruby Date gem can lead to a denial of service condition in affected applications. It is crucial to update the gem to one of the fixed versions (3.2.1, 3.1.2, 3.0.2, or 2.0.1) or implement input validation and sanitization to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ruby →
FAQ
The vulnerability can lead to a denial of service condition, where the application becomes unresponsive or crashes due to excessive CPU usage. This can disrupt the availability of the application and potentially impact its users.
If your application uses the Date gem and has not been updated to one of the fixed versions (3.2.1, 3.1.2, 3.0.2, or 2.0.1), it is likely affected by this vulnerability. You can use tools like Vulert (https://vulert.com/scanner) to check if your application is vulnerable.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
While updating the Date gem is the recommended solution, you can mitigate the vulnerability by implementing input validation and sanitization before passing user input to the Date.parse method. This can help prevent malicious inputs from triggering a ReDoS attack.
You can find more information about this vulnerability, including technical details and the fixed versions, in the official CVE-2021-41817 advisory: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41817.
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
